Storage device and memory controller thereof

ABSTRACT

A memory controller controlling a nonvolatile memory is provided. The memory controller includes an encryption key feeder configured to feed a cipher key according to a logical address transferred from a host; and an encryption engine configured to perform an encryption operation on data transferred from the host or a decryption operation on data transferred from the nonvolatile memory device, using the cipher key provided from the encryption key feeder.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a Divisional of U.S. application Ser. No. 13/674,174filed Nov. 12, 2012, which claims priority from Korean PatentApplication No. 10-2012-0020322 filed Feb. 28, 2012, in the KoreanIntellectual Property Office, the entire contents of which are herebyincorporated by reference.

BACKGROUND

Apparatuses, devices, and articles of manufacture consistent with thepresent disclosure relate to a storage device, and more particularly,relate to a storage device supporting an encryption operation and amemory controller thereof.

Semiconductor memory devices mainly used as a storage device may includevolatile memories such as a dynamic random access memory (DRAM), astatic RAM (SRRAM), and the like and nonvolatile memories such as anelectrically erasable and programmable ROM (EEPROM), a ferroelectric RAM(FRAM), a phase-change RAM (PRAM), a magnetoresistive RAM (MRAM), aflash memory, and the like. The volatile memories may lose contentsstored therein at power-off, while the nonvolatile memories may retaincontents stored therein even at power-off.

In recent years, devices using a nonvolatile memory may increase. Forexample, an MP3 player, a digital camera, a cellular phone, a camcorder,a flash card, and a solid state disk (SSD) may use a nonvolatile memoryas a storage device. Among nonvolatile memories, a flash memory maysupport a function of electrically erasing cell data in a lump. This mayenable the flash memory to be widely used as a storage device instead ofa hard disk drive.

As use in the storage device increases, the security of data stored inthe storage device may become important. Herein, the security of datamay be accomplished by preventing unpermitted user from reading datastored in the storage device.

SUMMARY

According to an aspect of an exemplary embodiment, there is provided amemory controller which controls a nonvolatile memory and includes anencryption key feeder configured to feed a cipher key according to alogical address transferred from a host; and an encryption engineconfigured to perform an encryption operation on data transferred fromthe host or a decryption operation on data transferred from thenonvolatile memory device, using the cipher key provided from theencryption key feeder.

The encryption key feeder may include a key mapper configured to managekey indexes corresponding to logical address ranges, and the key mappermay compare a logical address transferred from the host with the logicaladdress ranges.

The encryption key feeder may further include a key table moduleconfigured to manage cipher keys corresponding to the logical addressranges, and the key mapper may send a key index corresponding to one ofthe logical address ranges when a logical address transferred from thehost belongs to the one of the logical address ranges.

The key table module may provide the encryption engine with a cipherkey, corresponding to the key index, from among the cipher keys.

The memory controller may further include a microprocessor configured tocontrol the encryption engine and the encryption key feeder. The keymapper may provide an interrupt signal to the microprocessor when alogical address transferred from the host does not belong to any of thelogical address ranges.

The microprocessor may add a logical address range including the logicaladdress to the key mapper in response to the interrupt signal.

The key mapper may include a first register that stores locationinformation of a logical address range, of which a search operationstarts, from among the logical address ranges; and a second registerthat stores location information of a logical address range, of which asearch operation is being performed, from among the logical addressranges.

When a first logical address provided from the host does not belong to afirst logical address range of the logical address ranges, the keymapper may compare the first logical address with a next logical addressrange of the logical address ranges and stores location information ofthe next logical address range at the second register.

The key mapper may receive a second logical address from the hostfollowing an input of a first logical address. When the first logicaladdress belongs to a first logical address range of the logical addressranges, the key mapper may compare the second logical address with thefirst logical address range.

The key mapper may comprise a first comparator configured to compare alogical block address (LBA) lower bound value of the logical addressrange with the logical address; a second comparator configured tocompare an LBA upper bound value of the logical address range with thelogical address; and a logic gate configured to logically combine anoutput value of the first comparator and an output value of the secondcomparator.

According to an aspect of another exemplary embodiment, there isprovided a storage device including a nonvolatile memory device; and amemory controller configured to control the nonvolatile memory device.The memory controller includes an encryption engine configured toperform an encryption operation on data to be stored in the nonvolatilememory device or a decryption operation on data stored in thenonvolatile memory device; and an encryption key feeder configured toprovide the encryption engine with a cipher key according to a logicaladdress provided from a host.

The encryption key feeder may include a key mapper including a pluralityof key index entries, each of the plurality of key index entriesmanaging a logical address range and information associated with a keyindex; and a key table module including a plurality of encryption keyentries, each of the plurality of encryption key entries managinginformation associated with a cipher key corresponding to the key index.

The key mapper may include a search module configured to compare alogical address provided from a host with a logical address range of oneselected from the plurality of key index entries; and a current indexregister configured to store location information on an index, of whicha search operation is being performed by the search module, of theplurality of key index entries.

The key mapper may further include a search start register configured tostore location information on an entry, of which a search operationstarts, of the plurality of key index entries.

When the first logical address belongs to a logical address range of afirst key index entry of the plurality of key index entries, the searchmodule may first compare a second logical address provided following thefirst logical address with a logical address range of the first indexentry of the plurality of key index entries.

BRIEF DESCRIPTION OF THE DRAWINGS

The above and other aspects will become apparent from the followingdescription with reference to the following figures, wherein likereference numerals refer to like parts throughout the various figuresunless otherwise specified, and wherein:

FIG. 1 is a block diagram schematically illustrating an encryptiondevice according to an exemplary embodiment;

FIG. 2 is a block diagram schematically illustrating an encryptiondevice according to another exemplary embodiment;

FIG. 3 is a block diagram schematically illustrating an encryption keyfeeder in FIG. 2;

FIG. 4 is a detailed block diagram of a key mapper in FIG. 3;

FIG. 5 is a block diagram schematically illustrating a search module inFIG. 4;

FIG. 6 is a flowchart illustrating an operation of a key mapper in FIG.4;

FIG. 7 is a block diagram schematically illustrating a storage deviceaccording to an exemplary embodiment;

FIG. 8 is a block diagram schematically illustrating a memory cardsystem to which a memory system according to an exemplary embodiment isapplied;

FIG. 9 is a block diagram illustrating a solid state drive system inwhich a memory system according to an exemplary embodiment is applied;

FIG. 10 is a block diagram schematically illustrating an SSD controllerin FIG. 9;

FIG. 11 is a block diagram schematically illustrating an electronicdevice including a memory system according to an exemplary embodiment;

FIG. 12 is a block diagram schematically illustrating a flash memoryapplying an exemplary embodiment;

FIG. 13 is a perspective view schematically illustrating athree-dimensional (3D) structure of a memory block illustrated in FIG.12; and

FIG. 14 is a circuit diagram schematically illustrating an equivalentcircuit of a memory block illustrated in FIG. 13.

DETAILED DESCRIPTION

Exemplary embodiments will be described in detail with reference to theaccompanying drawings. The inventive concept, however, may be embodiedin various different forms, and should not be construed as being limitedonly to the illustrated exemplary embodiments. Rather, these exemplaryembodiments are provided as examples so that this disclosure will bethorough and complete, and will fully convey the concept of theinventive concept to those skilled in the art. Accordingly, knownprocesses, elements, and techniques are not described with respect tosome of the exemplary embodiments of the inventive concept. Unlessotherwise noted, like reference numerals denote like elements throughoutthe attached drawings and written description, and thus descriptionswill not be repeated. In the drawings, the sizes and relative sizes oflayers and regions may be exaggerated for clarity.

It will be understood that, although the terms “first”, “second”,“third”, etc., may be used herein to describe various elements,components, regions, layers and/or sections, these elements, components,regions, layers and/or sections should not be limited by these terms.These terms are only used to distinguish one element, component, region,layer or section from another region, layer or section. Thus, a firstelement, component, region, layer or section discussed below could betermed a second element, component, region, layer or section withoutdeparting from the teachings of the inventive concept.

Spatially relative terms, such as “beneath”, “below”, “lower”, “under”,“above”, “upper” and the like, may be used herein for ease ofdescription to describe one element or feature's relationship to anotherelement(s) or feature(s) as illustrated in the figures. It will beunderstood that the spatially relative terms are intended to encompassdifferent orientations of the device in use or operation in addition tothe orientation depicted in the figures. For example, if the device inthe figures is turned over, elements described as “below” or “beneath”or “under” other elements or features would then be oriented “above” theother elements or features. Thus, the exemplary terms “below” and“under” can encompass both an orientation of above and below. The devicemay be otherwise oriented (rotated 90 degrees or at other orientations)and the spatially relative descriptors used herein interpretedaccordingly. In addition, it will also be understood that when a layeris referred to as being “between” two layers, it can be the only layerbetween the two layers, or one or more intervening layers may also bepresent.

The terminology used herein is for the purpose of describing particularexemplary embodiments only and is not intended to be limiting of theinventive concept. As used herein, the singular forms “a”, “an” and“the” are intended to include the plural forms as well, unless thecontext clearly indicates otherwise. It will be further understood thatthe terms “comprises” and/or “comprising,” when used in thisspecification, specify the presence of stated features, integers, steps,operations, elements, and/or components, but do not preclude thepresence or addition of one or more other features, integers, steps,operations, elements, components, and/or groups thereof. As used herein,the term “and/or” includes any and all combinations of one or more ofthe associated listed items. Also, the term “exemplary” is intended torefer to an example or illustration.

It will be understood that when an element or layer is referred to asbeing “on”, “connected to”, “coupled to”, or “adjacent to” anotherelement or layer, it can be directly on, connected, coupled, or adjacentto the other element or layer, or intervening elements or layers may bepresent. In contrast, when an element is referred to as being “directlyon,” “directly connected to”, “directly coupled to”, or “immediatelyadjacent to” another element or layer, there are no intervening elementsor layers present.

Unless otherwise defined, all terms (including technical and scientificterms) used herein have the same meaning as commonly understood by oneof ordinary skill in the art to which this inventive concept belongs. Itwill be further understood that terms, such as those defined in commonlyused dictionaries, should be interpreted as having a meaning that isconsistent with their meaning in the context of the relevant art and/orthe present specification and will not be interpreted in an idealized oroverly formal sense unless expressly so defined herein.

Below, a storage device using a nonvolatile memory device may beexemplarily used to describe the inventive concept. Also, a flash memorymay be used as a nonvolatile memory. Alternatively, MRAM, ReRAM, FRAM,PRAM, NOR flash memory, and the like may be used as a nonvolatilememory, or a combination of heterogeneous memory devices may be used asa nonvolatile memory.

There will be exemplarily described the case that a logical blockaddress (LBA) is transferred from a host. However, the inventive conceptis not limited thereto. For example, logical addresses such as a logicalpage address, a logical sector address, and the like may be providedfrom host.

FIG. 1 is a block diagram schematically illustrating an encryptiondevice according to an exemplary embodiment. An encryption engine 100 inFIG. 1 may be used as a memory controller for controlling an externalnonvolatile memory device, and may include an encryption engine 120 forthe security of data stored in the nonvolatile memory device.

Referring to FIG. 1, the encryption device 100 may include a hostcontroller 110, the encryption engine 120, a host direct memory access(hereinafter, referred to as a host DMA) 130, a buffer memory 140, anonvolatile memory (NVM) direct memory access (hereinafter, referred toas an NVM DMA) 150, a nonvolatile memory (NVM) controller 160, and amicroprocessor 170.

The host controller 110 may provide physical interconnection between ahost and the encryption device 100. That is, the host controller 110 maybe configured to interface with the host according to a bus format ofthe host. The host format may include Universal Serial Bus (USB), PCIexpress, ATA, Parallel ATA (PATA), Serial ATA (SATA), or the like.

The host controller 110 may support a disk emulation function thatenables the host to recognize the encryption device 100 and an externalnonvolatile memory device connected to the encryption device 100 as ahard disk drive (HDD). For example, the host controller 110 may providea function such as a flash translation layer (FTL) for hiding an eraseoperation.

The encryption engine 120 may perform an encryption operation for safelystoring user data, which is transferred from a host, in an external NVMdevice. The encryption engine 120 may perform a decryption operation forproviding encrypted data stored in the external NVM device to the host.The encryption engine 120, for example, may be implemented to coincidewith Data Encryption Standard (DES), Triple-Data Encryption Standard(T-DES), Advanced Encryption Standard (AES), and the like.

The host DMA 130 may be in charge of a data transfer between the hostand the buffer memory 140. For example, the host DMA 130 may transferdata encrypted by the encryption engine 120 to the buffer memory 140, ormay transfer data temporarily stored in the buffer memory 140 to theencryption engine 120.

The buffer memory 140 may temporarily store encrypted data transferredfrom a host side. The buffer memory 140 may temporarily store encrypteddata read out from the external NVM device. The buffer memory 140 may beformed of a volatile memory such as DRAM, SRAM, or the like. However,the inventive concept is not limited thereto. For example, the buffermemory 116 may be formed of a nonvolatile memory such as a flash memoryor the like.

The NVM DMA 150 may be in charge of a data transfer between the buffermemory 140 and the NVM controller 160. For example, the NVM DMA 150 maytransfer encrypted data read out from the external NVM device to thebuffer memory 140.

The NVM controller 160 may be in charge of an interface between theencryption device 100 and the external NVM device. For example, the NVMcontroller 160 may be connected to the external NVM device via aplurality of channels, and may distribute encrypted data transferredfrom a host side to the external NVM device at a write operation. TheNVM controller 160 may receive encrypted data read out from the externalNVM device via the plurality of channels at a read operation.

The microprocessor 170 may control an overall operation of theencryption device 100. At a write operation or a read operation, themicroprocessor 170 may receive a logical block address (LBA) from a hostto provide the encryption engine 120 with an encryption keycorresponding to the input logical block address. The encryption engine120 may be configured to encrypt data or decrypt encrypted data, usingthe encryption key.

As described above, the encryption device 100 according to an exemplaryembodiment may be configured to search for an encryption keycorresponding to a logical block address using the microprocessor 170.In this case, limited performance of the microprocessor 170 due to thesearch for the encryption key may force performance to be lowered as toa read or write operation.

An external NVM device connected to the encryption device 100 may bedivided into a plurality of partitions logically or physically.Different encryption algorithms and encryption keys may be applied tothe partitions. In this case, the microprocessor 170 may search for anencryption key corresponding to a logical block address transferred froma host in the light of each partition. Thus, the performance of the reador write operation may be further lowered due to the additional burdenon the microprocessor 170.

Other exemplary embodiments for reducing the burden of themicroprocessor 170 and improving the read or write performance will bedescribed below.

FIG. 2 is a block diagram schematically illustrating an encryptiondevice according to another exemplary embodiment. In FIG. 2, elementsthat are similar to that in FIG. 1 are marked by similar referencenumerals, and description thereof is thus omitted.

Compared with an encryption device 100 in FIG. 1, the encryption devicein FIG. 2 may further include an encryption key feeder 280. Theencryption key feeder 280 may receive a logical block address LBA from ahost controller 210, and may search for an encryption algorithm, anencryption key, and the like corresponding to the input logical blockaddress to provide the encryption algorithm, the encryption key, and thelike to an encryption engine 220. The encryption engine 220 may performan encryption operation or a decryption operation using the transferredencryption algorithm and encryption key.

With the encryption device 200, the burden of a microprocessor 270 maybe reduced by the encryption key feeder 280 that is separately providedto search for an encryption key and so on. Thus, it is possible toprevent the performance from being lowered at a read or write operation.Further, in the event that an external NVM device is divided into aplurality of partitions, the performance may become higher than that ofthe encryption device 100 in FIG. 1.

FIG. 3 is a block diagram schematically illustrating an encryption keyfeeder in FIG. 2. Referring to FIG. 3, an encryption key feeder 280 mayinclude a key mapper 281 and a key table module 282.

The key mapper 281 may include a table having a plurality of entries.The table of the key mapper 281 may be used to manage informationassociated with a logical block address range LBA_RANGE and informationassociated with a key index corresponding to the logical block addressrange LBA_RANGE. The key mapper 281 may receive a logical block addressLBA from a host via a host controller 210 (refer to FIG. 1), and maydetermine whether there is a logical block address range LBA_RANGE whichthe input logical block address LBA belongs to

In the event that there is a logical block address range LBA_RANGE whichthe input logical block address LBA belongs to, the key mapper 281 mayprovide the key table module 282 with a key index corresponding to thelogical block address range LBA_RANGE.

If there is no logical block address range LBA_RANGE which the inputlogical block address LBA belongs to, the key mapper 281 may generate aninterrupt signal and send the interrupt signal to a microprocessor 270(refer to FIG. 2). The microprocessor 270 may perform a given operationin response to the interrupt signal.

For example, an interrupt signal may be generated when a password ofdata (or, partition) to be accessed by a host does not coincide with apassword input from the host. In this case, the microprocessor 270 mayinform the host that an access to corresponding data is not authorized,by sending an abort signal to the host via the host controller 210.

In another exemplary embodiment, in the event that although an accessauthority on data to be accessed is endowed the endowed access authorityis not managed by the key mapper 281, an interrupt signal may begenerated. In this case, the microprocessor 270 may perform an operationof adding an entry corresponding to a corresponding logical blockaddress to the key mapper 281.

The key table module 282 may include a table having a plurality ofentries. The table of the key table module 282 may be used to manageencryption information such as information associated with an encryptionalgorithm, information associated with a cipher key, informationassociated with a tweak key, and the like. However, the inventiveconcept is not limited thereto. For example, the table may be changedvariously according to an encryption method and a design method.

The key table module 282 may receive a key index from the key mapper 282to provide an encryption engine 220 (refer to FIG. 2) with encryptioninformation corresponding to the input key index. The encryption engine220 may perform an encryption or decryption operation using encryptioninformation transferred from the key table module 282.

An entry number of the key table module 282 may be identical to that ofthe key mapper 281. For example, if the entry number of the key tablemodule 282 is less than that of the key mapper 281, one entry of the keytable module 282 may share two or more entries of the key mapper 281.

The table of the key mapper 281 and the table of the key table module282 may be stored in a buffer memory 240 or in a memory independent fromthe buffer memory 240. Alternatively, the table of the key mapper 281and the table of the key table module 282 may be located on a bus. Inanother exemplary embodiment, the table of the key mapper 281 and thetable of the key table module 282 may be stored in an external NVMdevice, and may be, for example, loaded onto the buffer memory 240 atpower-up.

FIG. 4 is a detailed block diagram of a key mapper 281 in FIG. 3.Referring to FIG. 4, a key mapper 281 may include a key table 281_1, asearch start register 281_2, a current index register 281_3, and asearch module 281_4.

The key table 281_1 has a plurality of entries, and may be used tomanage information associated with a logical block address rangeLBA_RANGE and a key index. An entry of the key table 281_1 may beinformation associated with a logical block address range, and may beused to manage values, related to a lower bound and an upper bound of alogical block address LBA, and a value of a corresponding key index. Asillustrated in FIG. 4, there may be the case that different entries havethe same key index.

The search start register 281_2 may be used to record a location of anentry, the search operation of which is started, from among a pluralityof entries of the key table 281_1. For example, in a case where a searchoperation starts from an entry corresponding to a logical block range of<0, 1000>, the search start register 281_2 may take a value of ‘0’ to acorresponding entry, and may store a result.

The current index register 281_3 may be used to record a location of anentry, the search operation of which is being currently performed, fromamong the plurality of entries of the key table 281_1. For example, inthe case that a search operation of an entry corresponding to a logicalblock range of <0, 1000> is being performed first, the current indexregister 281_3 may take the same value (‘0’) as a value of the searchstart register 281_2 to a corresponding entry, and may store a result.

If an entry does not include a logical block address LBA transferredfrom a host, a next entry (hereinafter, referred to as a second entry)may be searched. At this time, the current index register 281_3 may takea value of ‘1’ for the second entry, and may store a result. The currentindex register 281_3 may take a value increased by ‘1’ whenever a searchoperation is performed for an entry, and may store a result.

If the key table 281_1 does not have an entry, that is, when all entriesof the key table 281_1 are searched, the current index register 281_3may again state the same value as that taken for an entry the searchoperation of which is first performed, that is, ‘0’.

The search module 281_4 may receive a logical block address LBA from ahost and LBA lower and upper bounds and a key index managed at aselected entry of the key table 281_1. The search module 281_4 mayperform a search operation for determining whether a logical blockaddress LBA provided from the host belongs to a logical block range of aselected entry.

When a logical block address LBA provided from the host does not belongto a logical block range of a selected entry, the search module 281_4may perform a search operation on a next entry.

If a logical block address LBA provided from the host belongs to alogical block range of a selected entry, the search module 281_4 maydetermine a corresponding entry as a hit entry, and may transfer a keyindex of the hit entry to a key table module 282 (refer to FIG. 3).

If a logical block address LBA provided from the host does not belong toa logical block range of a selected entry, that is, when a value storedin the search start register 281_2 is equal to that stored in thecurrent index register 281_3, the search module 281_4 may determine acorresponding logical block address LBA as a miss, and may send aninterrupt signal to a microprocessor 270.

A request and a logical block address LBA transmitted from a host mayhave temporal and spatial localities. Thus, an entry corresponding to acurrently requested logical block address may have temporal and spatiallocalities similar to that of an entry determined to be a hit entry. Forthis reason, if a search operation on an entry corresponding to acurrently requested logical block address is performed, the search startregister 281_2 may assign an entry being currently searched to an entrypreviously determined to be a hit entry. As a result, a time taken tosearch an entry may be reduced.

Also, while an encryption engine 220 (refer to FIG. 2) performs anencryption or decryption operation using an entry previously determinedto be a hit entry, a current command and logical block address may bereceived. In this case, if an entry previously determined to be a hitentry is lost, an encryption or decryption operation may be performedabnormally. In particular, in case that the number of entries managed bythe key table 281_1 is limited to a certain value, the chance that anentry previously determined to be a hit entry is lost may exist. Thisloss may be prevented by providing a microprocessor 270 with informationassociated with an entry determined to be a hit entry such that acorresponding entry in the key table 281_1 is not deleted.

FIG. 5 is a block diagram schematically illustrating a search module inFIG. 4. Referring to FIG. 5, a search module 281_4 may include twocomparators, a first comparator 1 and a second comparator 2 and an ANDgate 5, and may perform an operation of deciding a hit or miss.

The first comparator 1 may compare an LBA lower bound with a logicalblock address LBA. When a value of the logical block address LBA islarger than the LBA lower bound, the first comparator 1 may output avalue of ‘1’. When a value of the logical block address LBA is smallerthan the LBA lower bound, the first comparator 1 may output a value of‘0’.

The second comparator 2 may compare an LBA upper bound with a logicalblock address LBA. When a value of the logical block address LBA issmaller than the LBA upper bound, the second comparator 2 may output avalue of ‘1’. When a value of the logical block address LBA is largerthan or equal to the LBA upper bound, the second comparator 2 may outputa value of ‘0’.

The AND gate 3 may AND outputs of the first comparator 1 and the secondcomparator 2. The AND gate 3 may output a value of ‘1’ based on inputvalues, which denotes a hit. The AND gate 3 may output a value of ‘0’based on input values, which denotes a miss.

FIG. 6 is a flowchart illustrating an operation of a key mapper in FIG.4.

In operation S110, a key mapper 281 may receive a logical block addressLBA via a host controller 210 (refer to FIG. 2).

In operation S120, a current index register (CIR) 281_3 of the keymapper 281 may be reset to a first value. For example, a value of thecurrent index register 281_3 may be reset to a value of ‘0’.

In operation S130, a location of an entry of a key table 281_1 thesearch operation of which is started may be marked by a search startregister (SSR) 281_2. For example, when a value of ‘0’ stored in thecurrent index register 281_3 is backed up at the search start register281_2, an entry indicated by the current index register 281_3 may bebacked up at the search start register 281_2.

In operation S140, the search module 281_4 may compare the logical blockaddress LBA with a logical block address range LBA_RANGE of a currentlyselected entry. In operation S150, the search module 281_4 may determinewhether the logical block address LBA belongs to the logical blockaddress range LBA_RANGE of the currently selected entry, based on acomparison result.

When the logical block address LBA is determined to belong to thelogical block address range LBA_RANGE of the currently selected entry(“Yes” in operation S150), in operation S160, the search module 281_4may send a key index value of the selected entry to a key table module282 (refer to FIG. 3).

When the logical block address LBA is determined not to belong to thelogical block address range LBA_RANGE of the currently selected entry(“No” in operation S150), in operation S170, the search module 281_4 mayselect a next index of indexes of the key table 281_1, and may increasea value stored in the current index register 281_3 by “1”. In operationS180, the search module 281_4 may determine whether a value stored inthe current index register 281_3 coincides with a value stored in thesearch start register 281_2.

When a value stored in the current index register 281_3 coincides with avalue stored in the search start register 281_2 (“Yes” in operationS180), in operation S190, the search module 281_4 may determine thevalue to be miss, and may send an interrupt signal to a microprocessor270.

When a value stored in the current index register 281_3 does notcoincide with a value stored in the search start register 281_2 (“No” inoperation S180), the search module 281_4 may perform an operation ofcomparing the selected index with a value of the logical block addressLBA.

As described with reference to FIGS. 2 to 6, an encryption device 200 inFIG. 2 may include an encryption key feeder 280 that provides anencryption engine 200 with an encryption algorithm, a cipher key, andthe like. The encryption device 200 may reduce a burden of themicroprocessor 270 via the encryption key feeder 280. Thus, it ispossible to prevent the performance from being lowered at a read orwrite operation.

The encryption device 200 is applicable to various fields. Below,applications of the encryption device 200 will be described.

FIG. 7 is a block diagram schematically illustrating a storage deviceaccording to an exemplary embodiment. Referring to FIG. 7, a storagedevice 1000 may include a memory controller 1100 and a nonvolatilememory (NVM) device 1200. The memory controller 1100 may include anencryption engine 1110 and an encryption key feeder 1120.

The memory controller 1100 may control operations (e.g., reading,writing, erasing, etc.) of the NVM device 1200. The memory controller1100 may encrypt data transferred from a host using the encryptionengine 1110 and the encryption key feeder 1120, and may store theencrypted data in the NVM device 1200. The memory controller 1100 maydecrypt encrypted data stored in the NVM device 1200 using theencryption engine 1110 and the encryption key feeder 1120, and may sendthe decrypted data to the host. That is, as illustrated in FIG. 7, anencryption device 200 (refer to FIG. 2) may be used as the memorycontroller 1100 for controlling the NVM device 1200.

FIG. 8 is a block diagram schematically illustrating a memory cardsystem to which a memory system according to an exemplary embodiment. Amemory card system 200 may include a host 2100 and a memory card 2200.The host 2100 may include a host controller 2110, a host connection unit(CNT) 2120, and a DRAM 2130.

The host 2100 may write data in the memory card 2200 and read data fromthe memory card 2200. The host controller 2110 may send a command CMD(e.g., a write command), a clock signal CLK generated from a clockgenerator 2140 in the host 2100, and data to the memory card 2200 viathe host connection unit 2120. The DRAM 2130 may be a main memory of thehost 2100.

The memory card 2200 may include a card connection unit (CNT) 2210, acard controller 2220, and a flash memory 2230. The card controller 2220may store data in the flash memory 2230 in response to a command inputvia the card CNT 2210. The data may be stored in synchronization with aclock signal generated from a clock generator 2240 in the cardcontroller 2220. The flash memory 2230 may store data transferred fromthe host 2100. For example, in a case where the host 2100 is a digitalcamera, the flash memory 2230 may store image data.

In the memory card system 2000 in FIG. 8, the card controller 2220 mayinclude an encryption engine and an encryption key feeder for providinga cipher key to the encryption engine. Lowering of the performance at aread or write operation may be prevented by providing the encryption keyfeeder independently.

FIG. 9 is a block diagram illustrating a solid state drive system inwhich a memory system according to an exemplary embodiment is applied.Referring to FIG. 9, a solid state drive (SSD) system 3000 may include ahost 3100 and an SSD 3200. The host 3100 may include a host interface3111, a host controller 3120, and a DRAM 3130.

The host 3100 may write data in the SSD 3200 or read data from the SSD3200. The host controller 3120 may transfer signals SGL such as acommand, an address, a control signal, and the like to the SSD 3200 viathe host interface 3111. The DRAM 3130 may be a main memory of the host3100.

The SSD 3200 may exchange signals SGL with the host 3100 via the hostinterface 3211, and may be supplied with a power via a power connector3221. The SSD 3200 may include a plurality of nonvolatile memories NVM_1to NVM_n 3201 through 320 n, an SSD controller 3210, and an auxiliarypower supply 3220. Herein, the nonvolatile memories NVM_1 to NVM_n 3201to 320 n may be implemented by not only a NAND flash memory but alsoPRAM, MRAM, ReRAM, and the like.

The plurality of nonvolatile memories NVM_1 to NVM_n 3201 through 320 nmay be used as a storage medium of the SSD 3200. The plurality ofnonvolatile memories NVM_1 to NVM_n 3201 to 320 n may be connected withthe SSD controller 3210 via a plurality of channels CH1 to CHn. Onechannel may be connected with one or more nonvolatile memories.Nonvolatile memories connected with one channel may be connected withthe same data bus.

The SSD controller 3210 may exchange signals SGL with the host 3100 viathe host interface 3211. Herein, the signals SGL may include a command,an address, data, and the like. The SSD controller 3210 may beconfigured to write or read out data to or from a correspondingnonvolatile memory according to a command of the host 3100. The SSDcontroller 3210 will be more fully described with reference to FIG. 10.

The auxiliary power supply 3220 may be connected with the host 3100 viathe power connector 3221. The auxiliary power supply 3220 may be chargedby a power PWR from the host 3100. The auxiliary power supply 3220 maybe placed within the SSD 3200 or outside the SSD 3200. For example, theauxiliary power supply 3220 may be put on a main board to supply anauxiliary power to the SSD 3200.

FIG. 10 is a block diagram schematically illustrating an SSD controllerin FIG. 9. Referring to FIG. 10, an SSD controller 3210 may include anNVM interface (I/F) 3211, a host interface (I/F) 3212, an encryptionengine 3213, a controller 3214, an SRAM 3215, a DRAM 3216, and anencryption key feeder 3217.

The NVM interface 3211 may scatter data transferred from a main memoryof a host 3100 to channels CH1 to CHn, respectively. The NVM interface3211 may transfer data read from nonvolatile memories NVM_1 to NVM_n3201 to 320 n to a host 3100 via the host interface 3212.

The host interface 3212 may provide an interface with an SSD 3200according to the protocol of the host 3100. The host interface 3212 maycommunicate with the host 3100 using Universal Serial Bus (USB), SmallComputer System Interface (SCSI), PCI express, ATA, Parallel ATA (PATA),Serial ATA (SATA), Serial Attached SCSI (SAS), etc. The host interface3212 may perform a disk emulation function which enables the host 4100to recognize the SSD 3200 as a hard disk drive (HDD).

The SRAM 3215 may be used to drive software which efficiently managesthe nonvolatile memories NVM_1 3201 to NVM_n 320 n. The SRAM 3215 maystore metadata input from a main memory of the host 3100 or cache data.At a sudden power-off operation, metadata or cache data stored in theSRAM 3215 may be stored in the nonvolatile memories NVM_1 3201 to NVM_n320 n using an auxiliary power supply 3220.

The DRAM 3216 may temporarily store data transferred from a host or fromnonvolatile memories NVM_1 3201 to NVM_n 320 n. The DRAM 3216 may beplaced within the SSD controller 3210. However, the inventive concept isnot limited thereto. For example, the DRAM 3216 may be implemented to belocated outside the SSD controller 3210. In FIGS. 9 and 10, the SRAM3215 and the DRAM 3216 can be replaced with a nonvolatile memory. Thatis, an SSD system 3000 may be configured such that nonvolatile memoriessuch as PRAM, RRAM, MRAM, and the like perform roles of the SRAM 3215and the DRAM 3216.

The encryption engine 3213 may perform an encryption operation or adecryption operation on data. The encryption engine 3213 may beimplemented to correspond to Data Encryption Standard (DES), Triple-DataEncryption Standard (T-DES), Advanced Encryption Standard (AES), and thelike, for example.

The encryption key feeder 3217 may be configured to provide theencryption engine 3213 with a cipher key and the like. Lowering of theperformance at a read or write operation may be prevented by providingthe encryption key feeder independently.

FIG. 11 is a block diagram schematically illustrating an electronicdevice including a memory system according to an exemplary embodiment.Herein, an electronic device 4000 may be a personal computer or ahandheld electronic device such as a notebook computer, a cellularphone, a PDA, a camera, and the like.

Referring to FIG. 11, the electronic device 4000 may include a memorysystem 4100, a power supply 4200, an auxiliary power supply 4250, a CPU4300, a DRAM 4400, and a user interface 4500. The memory system 4100 mayinclude a flash memory 4110 and a memory controller 4120. The memorysystem 4100 can be embedded within the electronic device 4000.

As described above, the electronic device 4000 may include an encryptionengine and an encryption key feeder for providing the encryption enginewith a cipher key and the like. Lowering of the performance at a read orwrite operation may be prevented by providing the encryption key feederindependently.

A memory system according to an exemplary embodiment is applicable to aflash memory having a three-dimensional structure as well as a flashmemory having a two-dimensional structure.

FIG. 12 is a block diagram schematically illustrating a flash memoryapplied to the inventive concept. Referring to FIG. 12, a flash memory5000 may include a three-dimensional (3D) cell array 5110, a datainput/output (I/O) circuit 5120, an address decoder 5130, and controllogic 5140.

The 3D cell array 5110 may include a plurality of memory blocks BLK1 toBLKz, each of which is formed to have a three-dimensional structure (or,a vertical structure). For a memory block having a two-dimensional(horizontal) structure, memory cells may be formed in a directionhorizontal to a substrate. For a memory block having a three-dimensionalstructure, memory cells may be formed in a direction perpendicular tothe substrate. Each memory block may be an erase unit of the flashmemory 5000.

The data (I/O) circuit 5120 may be connected with the 3D cell array 5110via a plurality of bit lines BLs. The data (I/O) circuit 5120 mayreceive data from an external device or output data read from the 3Dcell array 5110 to the external device. The address decoder 5130 may beconnected with the 3D cell array 5110 via a plurality of word lines WLsand selection lines GSL and SSL. The address decoder 5130 may select theword lines in response to an address ADDR.

The control logic 5140 may control programming, erasing, reading, etc.of the flash memory 5000. For example, at programming, the control logic5140 may control the address decoder 5130 such that a program voltage issupplied to a selected word line, and may control the data input/outputcircuit 5120 such that data is programmed.

FIG. 13 is a perspective view schematically illustrating a 3D structureof a memory block illustrated in FIG. 12. Referring to FIG. 13, a memoryblock BLK1 may be formed in a direction perpendicular to a substrateSUB. An n+ doping region may be formed at the substrate SUB. A gateelectrode layer and an insulation layer may be deposited on thesubstrate SUB in turn. A charge storage layer may be formed between thegate electrode layer and the insulation layer.

If the gate electrode layer and the insulation layer are patterned in avertical direction, a V-shaped pillar may be formed. The pillar may beconnected with the substrate SUB via the gate electrode layer and theinsulation layer. An outer portion O of the pillar may be formed of achannel semiconductor, and an inner portion I thereof may be formed ofan insulation material such as silicon oxide.

The gate electrode layer of the memory block BLK1 may be connected witha ground selection line GSL, a plurality of word lines WL1 to WL8, and astring selection line SSL. The pillar of the memory block BLK1 may beconnected with a plurality of bit lines BL1 to BL3. In FIG. 13, there isillustrated the case that one memory block BLK1 has two selection linesSSL and GSL, eight word lines WL1 to WL8, and three bit lines BL1 toBL3. However, the inventive concept is not limited thereto.

FIG. 14 is a circuit diagram schematically illustrating an equivalentcircuit of a memory block illustrated in FIG. 13. Referring to FIG. 14,NAND strings NS11 to NS33 may be connected between bit lines BL1 to BL3and a common source line CSL. Each NAND string (e.g., NS11) may includea string selection transistor SST, a plurality of memory cells MC1 toMC8, and a ground selection transistor GST.

The string selection transistors SST may be connected with stringselection lines SSL1 to SSL3. The memory cells MC1 to MC8 may beconnected with corresponding word lines WL1 to WL8, respectively. Theground selection transistors GST may be connected with ground selectionline GSL. A string selection transistor SST may be connected with a bitline and a ground selection transistor GST may be connected with acommon source line CSL.

Word lines (e.g., WL1) having the same height may be connected incommon, and the string selection lines SSL1 to SSL3 may be separatedfrom one another. At programming of memory cells (constituting a page)connected with a first word line WL1 and included in NAND strings NS11,NS12, and NS13, there may be selected a first word line WL1 and a firststring selection line SSL1.

While the inventive concept has been described with reference toexemplary embodiments, it will be apparent to those skilled in the artthat various changes and modifications may be made without departingfrom the spirit and scope of the present inventive concept. Therefore,it should be understood that the above exemplary embodiments are notlimiting, but illustrative.

What is claimed is:
 1. A storage device comprising: a nonvolatile memorydevice; and a memory controller that is configured to control thenonvolatile memory device, wherein the memory controller comprises: anencryption key feeder configured to generate a cipher key according to alogical address transferred from a host; and an encryption engineconfigured to perform an encryption operation on data transferred fromthe host or a decryption operation on data transferred from thenonvolatile memory device using the cipher key provided from theencryption key feeder, wherein the encryption key feeder comprises a keymapper configured to manage key indexes corresponding to logical addressranges, and the key mapper compares a logical address transferred fromthe host with the logical address ranges, and wherein the key mappercomprises: a first comparator configured to compare a logical addressrange (LBA) lower bound value of the logical address range with thelogical address; a second comparator configured to compare an LBA upperbound value of the logical address range with the logical address; and alogic gate configured to logically combine an output value of the firstcomparator and an output value of the second comparator.
 2. The storagedevice of claim 1, wherein the encryption key feeder further comprises akey table module configured to manage cipher keys corresponding to thelogical address ranges, and the key mapper sends a key indexcorresponding to one of the logical address ranges when a logicaladdress transferred from the host belongs to the one of the logicaladdress ranges.
 3. The storage device of claim 2, wherein the key tablemodule provides the encryption engine with a cipher key, correspondingto the key index, from among a plurality of cipher keys.
 4. The storagedevice of claim 1, wherein the memory controller further comprises: amicroprocessor configured to control the encryption engine and theencryption key feeder, wherein the key mapper provides an interruptsignal to the microprocessor when a logical address transferred from thehost does not belong to any of the logical address ranges.
 5. Thestorage device of claim 4, wherein the microprocessor adds a logicaladdress range including the logical address to the key mapper inresponse to the interrupt signal.
 6. The storage device of claim 1,wherein the key mapper comprises: a first register that stores locationinformation of a logical address range, of which a search operationstarts, from among the logical address ranges; and a second registerthat stores location information of a logical address range, of which asearch operation is being performed, from among the logical addressranges.
 7. The storage device of claim 6, wherein when a first logicaladdress provided from the host does not belong to a first logicaladdress range of the logical address ranges, the key mapper compares thefirst logical address with a next logical address range of the logicaladdress ranges and stores location information of the next logicaladdress range in the second register.
 8. The storage device of claim ofclaim 1, wherein the key mapper receives a second logical address fromthe host following an input of a first logical address, and wherein whenthe first logical address belongs to a first logical address range ofthe logical address ranges, the key mapper compares the second logicaladdress with the first logical address range.
 9. The storage device ofclaim 1, wherein the nonvolatile memory device comprises athree-dimensional memory array.
 10. A storage device comprising: anonvolatile memory device that comprises a three-dimensional memoryarray; and a memory controller that controls the nonvolatile memorydevice, wherein the memory controller comprises: an encryption keyfeeder configured to generate a cipher key according to a logicaladdress transferred from a host; and an encryption engine configured toperform an encryption operation on data transferred from the host or adecryption operation on data transferred from the nonvolatile memorydevice using the cipher key provided from the encryption key feeder,wherein the encryption key feeder comprises a key mapper configured tomanage key indexes corresponding to logical address ranges, and the keymapper compares a logical address transferred from the host with thelogical address ranges, and wherein the encryption key feeder furthercomprises a key table module configured to manage cipher keyscorresponding to the logical address ranges, and the key mapper sends akey index corresponding to one of the logical address ranges when alogical address transferred from the host belongs to the one of thelogical address ranges.
 11. The storage device of claim 10, wherein thethree-dimensional memory array comprises a non-volatile memory that ismonolithically formed in one or more physical levels of memory cellshaving active areas disposed above a silicon substrate.
 12. The storagedevice of claim 10, wherein the key mapper comprises: a first comparatorconfigured to compare a logical address range (LBA) lower bound value ofthe logical address range with the logical address; a second comparatorconfigured to compare an LBA upper bound value of the logical addressrange with the logical address; and a logic gate configured to logicallycombine an output value of the first comparator and an output value ofthe second comparator.
 13. The storage device of claim 10, wherein thememory controller further comprises: a microprocessor configured tocontrol the encryption engine and the encryption key feeder, wherein thekey mapper provides an interrupt signal to the microprocessor when alogical address transferred from the host does not belong to any of thelogical address ranges.
 14. The storage device of claim 13, wherein themicroprocessor adds a logical address range including the logicaladdress to the key mapper in response to the interrupt signal.
 15. Thestorage device of claim 10, wherein the key mapper comprises: a firstregister that stores location information of a logical address range, ofwhich a search operation starts, from among the logical address ranges;and a second register that stores location information of a logicaladdress range, of which a search operation is being performed, fromamong the logical address ranges.
 16. The storage device of claim 15,wherein when a first logical address provided from the host does notbelong to a first logical address range of the logical address ranges,the key mapper compares the first logical address with a next logicaladdress range of the logical address ranges and stores locationinformation of the next logical address range in the second register.17. The storage device of claim of claim 10, wherein the key mapperreceives a second logical address from the host following an input of afirst logical address, and wherein when the first logical addressbelongs to a first logical address range of the logical address ranges,the key mapper compares the second logical address with the firstlogical address range.
 18. A method of a storage device, the methodcomprising: generating a cipher key, by an encryption key feeder,according to a logical address transferred from a host; performing anencryption operation or a decryption operation, by an encryption engine,on data transferred from the host or on data transferred from anonvolatile memory device using the cipher key provided from theencryption key feeder; wherein the cipher key is generated by comparinga logical address range (LBA) lower bound value of the logical addressrange with the logical address; comparing an LBA upper bound value ofthe logical address range with the logical address; and then logicallycombining an output value of comparison for the LBA lower bound valueand an output value of comparison for the LBA upper bound value.
 19. Themethod of claim 18, wherein the encryption key feeder comprises a keymapper configured to manage key indexes corresponding to logical addressranges and a key table module configured to manage cipher keyscorresponding to the logical address ranges.
 20. The method of claim 18,wherein the nonvolatile memory device comprises a three-dimensionalmemory array.